Vulnerability · Published Jun 25, 2024 · Assigned by Document Fdn.
CVE-2024-5261TLS certificate are not properly verified when utilizing LibreOfficeKit
Critical 10.0
In plain English
A critical-severity improper certificate validation in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents. LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers. In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl's TLS certification verification was disabled (CURLOPT_SSL_VERIFYPEER of false) In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true. This issue affects LibreOffice before version 24.2.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | libreoffice | 4:24.2.4-1 | DEBIAN-CVE-2024-5261 |
| Debian:14 | libreoffice | 4:24.2.4-1 | DEBIAN-CVE-2024-5261 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.4-0ubuntu0.24.04.2 | USN-6877-1 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.4-0ubuntu0.24.04.2 | UBUNTU-CVE-2024-5261 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Document Foundation | LibreOffice | 24.2 – before 24.2.4 |
Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H